refactor(configuration): consolidate firewall into one phase-aware path

roles/configuration/tasks/firewall.yml

@@ -0,0 +1,34 @@
+---
+- name: Enable the firewall daemon in the install chroot
+  when:
+    - firewall_phase == 'install'
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.firewall.enabled | bool
+  ansible.builtin.command: "{{ chroot_command }} systemctl enable {{ system_cfg.features.firewall.backend }}"
+  register: _firewall_enable
+  changed_when: _firewall_enable.rc == 0
+  failed_when: >-
+    _firewall_enable.rc != 0
+    and 'No such file or directory' not in (_firewall_enable.stderr | default(''))
+    and 'does not exist' not in (_firewall_enable.stderr | default(''))
+
+# ufw's CLI needs a running kernel and is a no-op in the chroot (leaves ENABLED=no),
+# so its activation and SSH rule are applied here, after reboot.
+- name: Allow SSH through ufw before enabling
+  when:
+    - firewall_phase == 'postreboot'
+    - system_cfg.features.firewall.backend == 'ufw'
+    - system_cfg.features.firewall.enabled | bool
+    - system_cfg.features.ssh.enabled | bool
+  ansible.builtin.command: ufw allow 22/tcp
+  register: _ufw_allow
+  changed_when: "'added' in _ufw_allow.stdout or 'updated' in _ufw_allow.stdout"
+
+- name: Activate ufw on the booted target
+  when:
+    - firewall_phase == 'postreboot'
+    - system_cfg.features.firewall.backend == 'ufw'
+    - system_cfg.features.firewall.enabled | bool
+  ansible.builtin.command: ufw --force enable
+  register: _ufw_enable
+  changed_when: "'active' in _ufw_enable.stdout"

roles/configuration/tasks/main.yml

@@ -5,6 +5,8 @@
 - name: Include configuration tasks
   when: configuration_task.when | default(true)
   ansible.builtin.include_tasks: "{{ configuration_task.file }}"
+  vars:
+    firewall_phase: install
   loop:
     - file: repositories.yml
     - file: banner.yml
@@ -12,6 +14,7 @@
     - file: locales.yml
     - file: ssh.yml
     - file: services.yml
+    - file: firewall.yml
     - file: grub.yml
     - file: encryption.yml
       when: "{{ system_cfg.luks.enabled | bool }}"

roles/configuration/tasks/services.yml

@@ -41,8 +41,6 @@
     configuration_systemd_services: >-
       {{
         ['NetworkManager']
-        + (['firewalld'] if system_cfg.features.firewall.backend == 'firewalld' and system_cfg.features.firewall.enabled | bool else [])
-        + (['ufw'] if system_cfg.features.firewall.backend == 'ufw' and system_cfg.features.firewall.enabled | bool else [])
         + ([_configuration_platform.ssh_service] if system_cfg.features.ssh.enabled | bool else [])
         + (['logrotate', 'systemd-timesyncd'] if os == 'archlinux' else [])
         + (['bluetooth'] if system_cfg.features.desktop.enabled | bool else [])